MySpace, which we recently wrote about due to its partnership with Google, has shut down hundreds of user profiles as a precaution to a worm which is infecting user computers via MySpace & Apple’s QuickTime media player. The worm seems to change user profiles and add malicious links and content when the video is played.
Joris Evers at CNet reports:
A malicious video on MySpace.com pages changes people’s profiles when played, embedding itself and adding links to fraudulent Web sites, experts have warned.
The video is a rigged QuickTime file that exploits a MySpace vulnerability and support for JavaScript in Apple Computer’s embedded media player, Web security firm Websense said in an alert posted on Friday.
When played by a MySpace user, the video adds itself to the user’s MySpace page and replaces the links on the user’s profile with links to phishing Web sites, Websense said. Phishing sites are fraudulent sites that attempt to trick people into giving up sensitive information such as log-in credentials.
And more from InformationWeek:
MySpace over the weekend shutdown hundreds of user profiles that had been infected by a worm that directed victims to a phishing site where they were asked to type in their user name and password, a security firm said.
As of Monday, all infected profiles on the popular social network had been taken down… The worm, which was discovered Friday, exploited the Javascript support within Apple Computer’s QuickTime player, which can be embedded in MySpace user profiles. The vulnerabilities were used to replace the legitimate links on MySpace profiles with links to the phishing site.
